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Ref: https://www.dynatrace.com/resources/ebooks/javabook/how-garbage-collection-works/ 
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Ref: https://www.pentestpartners.com/security-blog/how-to-extract-sensitive-plaintext-data-from-android-memory 
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compactl, compact2, compact3 
java.security destroy 
Class KeyStore.PasswordProtection public void destroy() 


throws DestroyFailedException 
java.lang.Object 


java.security.KeyStore.PasswordProtection Clears the password. 
All Implemented Interfaces: Specifled by: 
KeyStore.ProtectionParameter, Destroyable destroy in interface Destroyable 
Enclosing class: Throws: 
KeyStore DestroyFailedException - if this method was unable to clear the password 


public static class KeyStore.PasswordProtection 
extends Object 
implements KeyStore.ProtectionParameter, Destroyable 


A password-based implementation of ProtectionParameter. 


Ref: https://docs.oracle.com/javase/7/docs/api/java/security/KeyStore.PasswordProtection.html 
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కక్‌ క్‌ కక్‌. 
Instrumenting Android Apps with Soot, 


http://www.bodden.de/2013/01/08/soot-android-instrumentation/ 
Dexpler: Converting Android Dalvik Bytecode to Jimple for Static 


Analysis with Soot, https://arxiv.org/pdf/1205.3576.pdf 
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class MyClass{ 


HOOL static SB x; 0000 


public void foo(){ public static void foo(){ 


SB X, y, 25 SB y, Z; 
[x = new SB("s3cr3t");]! [x = new SB(“s3cr3t”);]! 
[y — new SB(“p@55w0rd”) p IE [y = new SB(“p@55wOrd”) 17 


[if(y.length() < x.length())4 [if(y.length() < x.length()) 4 
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[z = y;]* [z = $Bj+StringBuilder 
+ else{ 


[z = y.append (“007”); 1 ql = static void bart 11 


System.out.println(StaticSB.x); 


PI } 
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public static void foo(){ 
MyInstanceFieldSB obj = new 
MyInstanceFieldSB(); 
SB str- new SB(); 


obj.setSBx(str) 


S.O.P(obj.getSBx()); 


class MyInstanceFieldSB 
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private SB x; 


public SB getSBx(){ 


return X; 


} 
public SB setSBx(SB str){ 


x-str; 


Demo - HU] StringBuilder 


public class MainActivity public class CheckStatic { 


{ 


protected void onCreate(Bundle b) { public void useStaticField() 


S.0.P(User.static secret); 
bar(); 
} 


cs.useStaticField(); 


> public void bar() 
{ 

} S.0.P(User.static secret); 
} 
} 


public class User { 
public static SB static_secret; 
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Demo - Instance Feld SB 


1. [] StringBuilder rir 
public class MainActivity{ le 
public static void onCreate(){ 4. TI MyClass (00000 
class MyClass 
SB my secret- new SB("S3cr3t"); { 
MyClass mc = new MyClass(); private SB a; 


Wrapper w = new Wrapper(); 


public SB setA(SB str){ 
a=str; 


w.callW(mc, my secret); — “mc” MU 


resetSb A();"—: DIM 


public void resetSb_A(){ 
} 


} 
SB my secret ){ 


mc.setA(my secret); 
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Twitter: @samitanwerl, 
Email: 
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1. U ETS an intra proce cura! data flow Anas in Soot, 


2. Instrumenting Android Apps with Soot, 
http://www.bodden.de/2013/01/08/soot-android-instrumentation 


3. Dexpler: Converting Android Dalvik Bytecode to Jimple for Static Analysis with Soot, 
https://arxiv.org/pdf/1205.3576.pdf 


4. Precise Interprocedural Dataflow Analysis via Graph Reachability, 


https://courses.cs.washington.edu/courses/cse590md/01sp/w112.pdf 


5. Slides by Matthew B. Dwyer and Robby, University of Nebraska-Lincoln, Kansas State University 
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public int foo(java.lang.String) { 
// (local defs] 
rð := @this; // IdentityStmt 
rl := @parameter0; 


if rl != null goto label0; // IfStmt 


$10 = rl.length(); // AssignStmt 

rl.toUpperCase ); // InvokeStmt 

return $10; // ReturnStmt 
label0: 

return 2; 


